./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1233895304

<...>
[   91.882674][   T24] cfg80211: failed to load regulatory.db
Warning: Permanently added '10.128.0.104' (ED25519) to the list of known hosts.
execve("./syz-executor1233895304", ["./syz-executor1233895304"], 0x7fff0aaa0d20 /* 10 vars */) = 0
brk(NULL)                               = 0x555581f68000
brk(0x555581f68d00)                     = 0x555581f68d00
arch_prctl(ARCH_SET_FS, 0x555581f68380) = 0
set_tid_address(0x555581f68650)         = 5848
set_robust_list(0x555581f68660, 24)     = 0
rseq(0x555581f68ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor1233895304", 4096) = 28
getrandom("\xc6\x0b\x53\x84\xe2\x2c\x93\x7f", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x555581f68d00
brk(0x555581f89d00)                     = 0x555581f89d00
brk(0x555581f8a000)                     = 0x555581f8a000
mprotect(0x7f13b4528000, 16384, PROT_READ) = 0
mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000
mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000
mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000
write(1, "executing program\n", 18executing program
)     = 18
memfd_create("syzkaller", 0)            = 3
mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f13ac000000
write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216
munmap(0x7f13ac000000, 138412032)       = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 4
ioctl(4, LOOP_SET_FD, 3)                = 0
close(3)                                = 0
close(4)                                = 0
mkdir("./bus", 0777)                    = 0
mount("/dev/loop0", "./bus", "jfs", 0, "") = 0
openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = 3
chdir("./bus")                          = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = -1 EBUSY (Device or resource busy)
openat(AT_FDCWD, "hugetlb.1GB.usage_in_bytes", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
openat(AT_FDCWD, ".", O_RDONLY)         = 5
[   94.586954][ T5848] loop0: detected capacity change from 0 to 32768
[   94.640131][ T5848] ==================================================================
[   94.648256][ T5848] BUG: KASAN: slab-out-of-bounds in dtReadFirst+0x502/0x930
[   94.655590][ T5848] Read of size 4 at addr ffff888074d5c028 by task syz-executor123/5848
[   94.663941][ T5848] 
[   94.666324][ T5848] CPU: 0 UID: 0 PID: 5848 Comm: syz-executor123 Not tainted 6.16.0-rc5-syzkaller-00038-g733923397fd9 #0 PREEMPT(full) 
[   94.666347][ T5848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
[   94.666365][ T5848] Call Trace:
[   94.666378][ T5848]  <TASK>
[   94.666386][ T5848]  dump_stack_lvl+0x189/0x250
[   94.666409][ T5848]  ? rcu_is_watching+0x15/0xb0
[   94.666428][ T5848]  ? __kasan_check_byte+0x12/0x40
[   94.666455][ T5848]  ? __pfx_dump_stack_lvl+0x10/0x10
[   94.666473][ T5848]  ? rcu_is_watching+0x15/0xb0
[   94.666491][ T5848]  ? lock_release+0x4b/0x3e0
[   94.666507][ T5848]  ? _raw_spin_lock_irqsave+0xb3/0xf0
[   94.666537][ T5848]  ? __virt_addr_valid+0x1c8/0x5c0
[   94.666558][ T5848]  ? __virt_addr_valid+0x4a5/0x5c0
[   94.666579][ T5848]  print_report+0xd2/0x2b0
[   94.666604][ T5848]  ? dtReadFirst+0x502/0x930
[   94.666621][ T5848]  kasan_report+0x118/0x150
[   94.666645][ T5848]  ? kernel_text_address+0xa5/0xe0
[   94.666671][ T5848]  ? dtReadFirst+0x502/0x930
[   94.666692][ T5848]  dtReadFirst+0x502/0x930
[   94.666716][ T5848]  jfs_readdir+0x709/0x3ae0
[   94.666749][ T5848]  ? __pfx_jfs_readdir+0x10/0x10
[   94.666778][ T5848]  ? down_write+0x162/0x1f0
[   94.666796][ T5848]  ? __pfx_down_write+0x10/0x10
[   94.666834][ T5848]  ? __pfx_jfs_readdir+0x10/0x10
[   94.666855][ T5848]  wrap_directory_iterator+0x96/0xe0
[   94.666883][ T5848]  iterate_dir+0x5af/0x770
[   94.666910][ T5848]  __se_sys_getdents64+0xe4/0x260
[   94.666937][ T5848]  ? __pfx___se_sys_getdents64+0x10/0x10
[   94.666963][ T5848]  ? __pfx_filldir64+0x10/0x10
[   94.666989][ T5848]  ? rcu_is_watching+0x15/0xb0
[   94.667014][ T5848]  do_syscall_64+0xfa/0x3b0
[   94.667031][ T5848]  ? lockdep_hardirqs_on+0x9c/0x150
[   94.667052][ T5848]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   94.667066][ T5848]  ? clear_bhb_loop+0x60/0xb0
[   94.667091][ T5848]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   94.667104][ T5848] RIP: 0033:0x7f13b44af6b9
[   94.667121][ T5848] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   94.667133][ T5848] RSP: 002b:00007ffe15ba1748 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
[   94.667148][ T5848] RAX: ffffffffffffffda RBX: 00007ffe15ba1918 RCX: 00007f13b44af6b9
[   94.667158][ T5848] RDX: 00000000000000a2 RSI: 00002000000002c0 RDI: 0000000000000005
[   94.667167][ T5848] RBP: 00007f13b4528610 R08: 0000000000000000 R09: 00007ffe15ba1918
[   94.667176][ T5848] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[   94.667184][ T5848] R13: 00007ffe15ba1908 R14: 0000000000000001 R15: 0000000000000001
[   94.667199][ T5848]  </TASK>
[   94.667204][ T5848] 
[   94.925415][ T5848] Allocated by task 5848:
[   94.929749][ T5848]  kasan_save_track+0x3e/0x80
[   94.934442][ T5848]  __kasan_slab_alloc+0x6c/0x80
[   94.939304][ T5848]  kmem_cache_alloc_lru_noprof+0x1c6/0x3d0
[   94.945120][ T5848]  jfs_alloc_inode+0x28/0x70
[   94.949713][ T5848]  alloc_inode+0x6a/0x1b0
[   94.954060][ T5848]  new_inode+0x22/0x170
[   94.958218][ T5848]  ialloc+0x4c/0x8f0
[   94.962117][ T5848]  jfs_create+0x18d/0xa80
[   94.966450][ T5848]  path_openat+0x14f4/0x3830
[   94.971049][ T5848]  do_filp_open+0x1fa/0x410
[   94.975650][ T5848]  do_sys_openat2+0x121/0x1c0
[   94.980332][ T5848]  __x64_sys_openat+0x138/0x170
[   94.985191][ T5848]  do_syscall_64+0xfa/0x3b0
[   94.989701][ T5848]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   94.995601][ T5848] 
[   94.997925][ T5848] The buggy address belongs to the object at ffff888074d5b750
[   94.997925][ T5848]  which belongs to the cache jfs_ip of size 2232
[   95.011724][ T5848] The buggy address is located 32 bytes to the right of
[   95.011724][ T5848]  allocated 2232-byte region [ffff888074d5b750, ffff888074d5c008)
[   95.026534][ T5848] 
[   95.028866][ T5848] The buggy address belongs to the physical page:
[   95.035290][ T5848] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x74d58
[   95.044063][ T5848] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   95.052654][ T5848] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[   95.060213][ T5848] page_type: f5(slab)
[   95.064199][ T5848] raw: 00fff00000000040 ffff8881432b5780 dead000000000122 0000000000000000
[   95.072794][ T5848] raw: 0000000000000000 00000000800d000d 00000000f5000000 0000000000000000
[   95.081386][ T5848] head: 00fff00000000040 ffff8881432b5780 dead000000000122 0000000000000000
[   95.090058][ T5848] head: 0000000000000000 00000000800d000d 00000000f5000000 0000000000000000
[   95.098752][ T5848] head: 00fff00000000003 ffffea0001d35601 00000000ffffffff 00000000ffffffff
[   95.107453][ T5848] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[   95.116121][ T5848] page dumped because: kasan: bad access detected
[   95.122541][ T5848] page_owner tracks the page as allocated
[   95.128261][ T5848] page last allocated via order 3, migratetype Reclaimable, gfp_mask 0xd2050(__GFP_RECLAIMABLE|__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5848, tgid 5848 (syz-executor123), ts 94621289604, free_ts 30638481918
[   95.150935][ T5848]  post_alloc_hook+0x240/0x2a0
[   95.155716][ T5848]  get_page_from_freelist+0x21d5/0x22b0
[   95.161273][ T5848]  __alloc_frozen_pages_noprof+0x181/0x370
[   95.167084][ T5848]  alloc_pages_mpol+0x232/0x4a0
[   95.171949][ T5848]  allocate_slab+0x8a/0x3b0
[   95.176455][ T5848]  ___slab_alloc+0xbfc/0x1480
[   95.181136][ T5848]  kmem_cache_alloc_lru_noprof+0x288/0x3d0
[   95.186952][ T5848]  jfs_alloc_inode+0x28/0x70
[   95.191547][ T5848]  alloc_inode+0x6a/0x1b0
[   95.195888][ T5848]  new_inode+0x22/0x170
[   95.200047][ T5848]  jfs_fill_super+0x569/0xd90
[   95.204733][ T5848]  get_tree_bdev_flags+0x40b/0x4d0
[   95.209850][ T5848]  vfs_get_tree+0x92/0x2b0
[   95.214274][ T5848]  do_new_mount+0x24a/0xa40
[   95.218785][ T5848]  __se_sys_mount+0x317/0x410
[   95.223465][ T5848]  do_syscall_64+0xfa/0x3b0
[   95.227972][ T5848] page last free pid 1 tgid 1 stack trace:
[   95.233785][ T5848]  __free_frozen_pages+0xc65/0xe60
[   95.238911][ T5848]  free_contig_range+0x1bd/0x4a0
[   95.243877][ T5848]  destroy_args+0x7e/0x5d0
[   95.248305][ T5848]  debug_vm_pgtable+0x412/0x450
[   95.253164][ T5848]  do_one_initcall+0x233/0x820
[   95.257936][ T5848]  do_initcall_level+0x137/0x1f0
[   95.262880][ T5848]  do_initcalls+0x69/0xd0
[   95.267220][ T5848]  kernel_init_freeable+0x3d9/0x570
[   95.272432][ T5848]  kernel_init+0x1d/0x1d0
[   95.276777][ T5848]  ret_from_fork+0x3f9/0x770
[   95.281383][ T5848]  ret_from_fork_asm+0x1a/0x30
[   95.286172][ T5848] 
[   95.288507][ T5848] Memory state around the buggy address:
[   95.294152][ T5848]  ffff888074d5bf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   95.302225][ T5848]  ffff888074d5bf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   95.310300][ T5848] >ffff888074d5c000: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   95.318454][ T5848]                                   ^
[   95.323829][ T5848]  ffff888074d5c080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   95.331985][ T5848]  ffff888074d5c100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   95.340059][ T5848] ==================================================================
[   95.355764][ T5848] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   95.363032][ T5848] CPU: 1 UID: 0 PID: 5848 Comm: syz-executor123 Not tainted 6.16.0-rc5-syzkaller-00038-g733923397fd9 #0 PREEMPT(full) 
[   95.375553][ T5848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
[   95.385611][ T5848] Call Trace:
[   95.388893][ T5848]  <TASK>
[   95.391827][ T5848]  dump_stack_lvl+0x99/0x250
[   95.396424][ T5848]  ? __asan_memcpy+0x40/0x70
[   95.401014][ T5848]  ? __pfx_dump_stack_lvl+0x10/0x10
[   95.406216][ T5848]  ? __pfx__printk+0x10/0x10
[   95.410816][ T5848]  panic+0x2db/0x790
[   95.414722][ T5848]  ? __pfx_preempt_schedule+0x10/0x10
[   95.420101][ T5848]  ? __pfx_panic+0x10/0x10
[   95.424524][ T5848]  ? _raw_spin_unlock_irqrestore+0xfd/0x110
[   95.430445][ T5848]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   95.436780][ T5848]  ? dtReadFirst+0x502/0x930
[   95.441377][ T5848]  check_panic_on_warn+0x89/0xb0
[   95.446344][ T5848]  ? dtReadFirst+0x502/0x930
[   95.450942][ T5848]  end_report+0x78/0x160
[   95.455199][ T5848]  kasan_report+0x129/0x150
[   95.459713][ T5848]  ? kernel_text_address+0xa5/0xe0
[   95.464842][ T5848]  ? dtReadFirst+0x502/0x930
[   95.469439][ T5848]  dtReadFirst+0x502/0x930
[   95.473961][ T5848]  jfs_readdir+0x709/0x3ae0
[   95.478488][ T5848]  ? __pfx_jfs_readdir+0x10/0x10
[   95.483442][ T5848]  ? down_write+0x162/0x1f0
[   95.488046][ T5848]  ? __pfx_down_write+0x10/0x10
[   95.492918][ T5848]  ? __pfx_jfs_readdir+0x10/0x10
[   95.497861][ T5848]  wrap_directory_iterator+0x96/0xe0
[   95.503247][ T5848]  iterate_dir+0x5af/0x770
[   95.507675][ T5848]  __se_sys_getdents64+0xe4/0x260
[   95.512708][ T5848]  ? __pfx___se_sys_getdents64+0x10/0x10
[   95.518353][ T5848]  ? __pfx_filldir64+0x10/0x10
[   95.523122][ T5848]  ? rcu_is_watching+0x15/0xb0
[   95.527888][ T5848]  do_syscall_64+0xfa/0x3b0
[   95.532390][ T5848]  ? lockdep_hardirqs_on+0x9c/0x150
[   95.537598][ T5848]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   95.543669][ T5848]  ? clear_bhb_loop+0x60/0xb0
[   95.548341][ T5848]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   95.554228][ T5848] RIP: 0033:0x7f13b44af6b9
[   95.558635][ T5848] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   95.578236][ T5848] RSP: 002b:00007ffe15ba1748 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
[   95.586775][ T5848] RAX: ffffffffffffffda RBX: 00007ffe15ba1918 RCX: 00007f13b44af6b9
[   95.594839][ T5848] RDX: 00000000000000a2 RSI: 00002000000002c0 RDI: 0000000000000005
[   95.602811][ T5848] RBP: 00007f13b4528610 R08: 0000000000000000 R09: 00007ffe15ba1918
[   95.610785][ T5848] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[   95.618756][ T5848] R13: 00007ffe15ba1908 R14: 0000000000000001 R15: 0000000000000001
[   95.626739][ T5848]  </TASK>
[   95.630129][ T5848] Kernel Offset: disabled
[   95.634462][ T5848] Rebooting in 86400 seconds..